A stored cross‑site scripting flaw existed in Lookyloo’s capture tree visualization page. The application serialized the capture tree directly into an inline JavaScript block using Jinja’s safe filter. Because the tree data can include values derived from captured, potentially attacker‑controlled web content, a crafted value could prematurely terminate the surrounding <script> element and inject arbitrary HTML or JavaScript. When a user views the affected capture tree, the malicious code runs in their browser. This enables an attacker to execute any JavaScript within the victim’s authenticated session, gaining access to information and the ability to perform actions or modify data that the victim is authorized to manipulate.

The vulnerability affects the Lookyloo web application, specifically the capture tree visualization component. No specific product version information is listed. The issue is present in any deployment that uses the unpatched code path for rendering the capture tree.

The vulnerability carries a CVSS score of 9.2, indicating a high‑severity risk. EPSS score is 0.00277, indicating a very low exploitation probability, and the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector involves an attacker creating a malicious capture tree that the victim subsequently opens. Once the victim’s browser processes the embedded JSON, the injected script executes with the victim’s privileges, allowing session‑based actions or data tampering within the victim’s authority scope.